DEBIAN-CVE-2008-5906

Eval injection vulnerability in the web interface plugin in KTorrent before 3.1.4 allows remote attackers to execute arbitrary PHP code via unspecified parameters to this interface's PHP scripts...

CVE-2008-5792

PHP remote file inclusion vulnerability in showjoined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: the researcher also points out the analogous directory traversal issue...

Directory traversal

PHP remote file inclusion vulnerability in showjoined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter. NOTE: the researcher also points out the analogous directory traversal issue...

Enthusiast 3 Remote Code Execution

www.BugReport.ir AmnPardaz Security Research Team Title: Enthusiast 3 Remote Code Execution Vendor: http://scripts.indisguise.org/enthusiast/ Bug: File Inclusion Vulnerable Version: 3.1.4 prior versions also may be affected Exploitation: Remote with browser Fix: N/A Original Advisory:...

enthusiast-exec.txt

www.BugReport.ir AmnPardaz Security Research Team Title: Enthusiast 3 Remote Code Execution Vendor: http://scripts.indisguise.org/enthusiast/ Bug: File Inclusion Vulnerable Version: 3.1.4 prior versions also may be affected Exploitation: Remote with browser Fix: N/A Original Advisory:...

Enthusiast 3.1.4 (show_joined.php path) Remote File Inclusion Vuln

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: Enthusiast 3 Remote Code Execution Vendor: http://scripts.indisguise.org/enthusiast/ Bug: File Inclusion Vulnerable Version: 3.1.4 prior versions also may be affected Exploitation: Remote with browser Fix:...

Enthusiast 3.1.4 - 'show_joined.php' Remote File Inclusion

www.BugReport.ir AmnPardaz Security Research Team Title: Enthusiast 3 Remote Code Execution Vendor: http://scripts.indisguise.org/enthusiast/ Bug: File Inclusion Vulnerable Version: 3.1.4 prior versions also may be affected Exploitation: Remote with browser Fix: N/A Original Advisory:...

Enthusiast 3.1.4 - show_joined.php Remote File Inclusion

Enthusiast 3.1.4 - showjoined.php Remote File Inclusion www.BugReport.ir AmnPardaz Security Research Team Title: Enthusiast 3 Remote Code Execution Vendor: http://scripts.indisguise.org/enthusiast/ Bug: File Inclusion Vulnerable Version: 3.1.4 prior versions also may be affected Exploitation:...

joovili-insecure.txt

Joovili Script Insecure Cookie Handling Vulnerability version: 3.1.4 ---------------------------------------------------------- Discovered By: ZoRLu Date: 02.11.2008 Home: www.z0rlu.blogspot.com contact: [email protected] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : N0T: a.q kpss :...

Joovili 3.1.4 - Insecure Cookie Handling

Joovili Script Insecure Cookie Handling Vulnerability version: 3.1.4 ---------------------------------------------------------- Discovered By: ZoRLu Date: 02.11.2008 Home: www.z0rlu.blogspot.com contact: [email protected] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : N0T: a.q kpss :...

Joovili 3.1.4 - Insecure Cookie Handling

Joovili 3.1.4 - Insecure Cookie Handling Joovili Script Insecure Cookie Handling Vulnerability version: 3.1.4 ---------------------------------------------------------- Discovered By: ZoRLu Date: 02.11.2008 Home: www.z0rlu.blogspot.com contact: [email protected] N0T: YALNIZLIK, YiTiRDi ANLAMIN...

Joovili 3.1.4 Insecure Cookie Handling Vulnerability

Exploit for unknown platform in category web applications ==================================================== Joovili 3.1.4 Insecure Cookie Handling Vulnerability ==================================================== Joovili Script Insecure Cookie Handling Vulnerability version: 3.1.4...

Fedora 9 : ktorrent-3.1.4-1.fc9 (2008-9167)

Another bugfix release for the 3.1 series is out. This fixes several bugs : A crash caused by a SIGBUS, when diskspace preallocation is disabled High CPU usage when DNS lookups fail in the UDP tracker code Several security issues in the webinterface plugin Note that Tenable Network Security has...

Caucho Resin vulnerable to XSS via "file" parameter to "viewfile"

Overview The "viewfile" command provided by Caucho Resin contains a cross-site scripting XSS vulnerability in the "file" parameter. Description Caucho Resin is a Java-based application server. The "viewfile" command that is provided with the Resin documentation is vulnerable to XSS via the "file"...

CVE-2008-2105

emailin.pl in Bugzilla 2.23.4, 3.0.x before 3.0.4, and 3.1.x before 3.1.4 allows remote authenticated users to more easily spoof the changer of a bug via a @reporter command in the body of an e-mail message, which overrides the e-mail address as normally obtained from the From e-mail header. NOTE...

Debian DSA-1544-2 : pdns-recursor - design flaw

Amit Klein discovered that pdns-recursor, a caching DNS resolver, uses a weak random number generator to create DNS transaction IDs and UDP source port numbers. As a result, cache poisoning attacks were simplified. CVE-2008-1637 and CVE-2008-3217 %NASLMINLEVEL 70300 C Tenable Network Security, In...

Horde Framework 3.1.3 - 'login.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/22984/info Horde Framework is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would execute in the context of the affected site, potentially...

CVE-2005-4245

Cross-site scripting XSS vulnerability in search.php in Snipe Gallery 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyword parameter...

CVE-2005-4244

The vulnerability CVE-2005-4244 affects Snipe Gallery 3.1.4 and earlier. It is an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the gallery_id parameter to view.php and the image_id parameter to image.php. Details indicate an injection flaw in how ...

CVE-2005-4245

CVE-2005-4245 is a cross-site scripting (XSS) vulnerability in Snipe Gallery 3.1.4 and earlier affecting the file search.php . The issue arises from the keyword parameter, allowing remote attackers to inject arbitrary web script or HTML. According to the record, the impact is confidentiality: non...